CSE508: Network Security, Spring 2021

Introduction and Basic Concepts Cancelled due to winter storm

Introduction and Basic Concepts slides

Reflections on Trusting Trust
Why Offensive Security Needs Engineering Textbooks

Ethics slides

Legal Issues Surrounding Monitoring During Network Research
About Penetration Testing
Markets for Zero-Day Exploits: Ethics and Implications
Cybercrime: An Overview of the Federal Computer Fraud and Abuse Statute and Related Federal Criminal Laws
Policy and Disclosure: 2020 Edition

Lower Layers (Part 1) slides

Packets Found on an Internet
tcpdump | Wireshark | Scapy

Homework 1 is out (due 2/26): Passive Network Monitoring

Lower Layers (Part 2) slides

A look back at “Security problems in the TCP/IP protocol suite”
IP-spoofing Demystified
Blind TCP/IP hijacking is still alive
Windows 7 TCP/IP Hijacking
Beej's Guide to Network Programming TCP Puzzlers

Hands-on Session

Homework 2 is out (due 3/12): Network Traffic Sniffing

Core Protocols: BGP slides

A Survey of BGP Security Issues and Solutions
Why Is It Taking So Long to Secure Internet Routing?

Core Protocols: DNS slides

Using the Domain Name System for System Break-ins
Corrupted DNS Resolution Paths: The Rise of a Malicious Resolution Authority
Hold-On: Protecting Against On-Path DNS Poisoning
An Illustrated Guide to the Kaminsky DNS Vulnerability
Drive-By Pharming
The power of DNS rebinding: stealing WiFi passwords with a website
DNS Security: Threat Modeling DNSSEC, DoT, and DoH
DNSSEC Deconstructed
Adopting Encrypted DNS in Enterprise Environments
A simple DNS lookup tool

Denial of Serviceslides

Inferring Internet Denial-of-Service Activity
A Taxonomy of DDoS Attack and DDoS Defense Mechanisms
Amplification Hell: Revisiting Network Protocols for DDoS Abuse
China’s Great Cannon

Firewalls and Tunnelsslides

Firewalls and Internet Security: Repelling the Wily Hacker (Second Edition)
Walls and Gates
Everything VPN is New Again
NAT Slipstreaming v2.0
Wireguard
Algo VPN
Embracing a Zero Trust Security Model
BeyondProd: A new approach to cloud-native security

Symmetric Key Cryptographyslides

Handbook of Applied Cryptography
A Graduate Course in Applied Cryptography
How (not) to use symmetric encryption
An Empirical Study of Cryptographic Misuse in Android Applications
The Matasano Crypto Challenges

Homework 3 is out (due 4/9): DNS Poisoning

Public Key Cryptographyslides

Applied Crypto Hardening
WhatsApp Encryption Overview
ECDSA: The digital signature algorithm of a better internet

Hands-on Session

Authenticationslides

A Framework for Comparative Evaluation of Web Authentication Schemes
Dos and Don’ts of Client Authentication on the Web
Designing an Authentication System: a Dialogue in Four Scenes
How To Add A Security Key To Your Gmail

TLSslides

Transport Layer Security (TLS)
Analyzing Forged SSL Certificates in the Wild
Analysis of the HTTPS Certificate Ecosystem
Killed by Proxy: Analyzing Client-end TLS Interception Software
Eliminating Obsolete Transport Layer Security (TLS) ProtocolConfigurations
Certificate Transparency
SSL/TLS and PKI History

Authentication/TLS (cont.)

Homework 4 is out (due 4/30): Plugboard Proxy

Hands-on Session

No Class

Reconnaissanceslides

nmap
The Art of Port Scanning
ZMap: Fast Internet-Wide Scanning and its Security Applications
A Brief History of Scanning
An Internet-Wide View of Internet-Wide Scanning

Malwareslides

The Art of Computer Virus Research and Defense
How to 0wn the Internet in Your Spare Time
Manufacturing Compromise: The Emergence of Exploit-as-a-Service
Evasive Malware Exposed and Deconstructed
The Inside Story Behind MS08-067
NTIllusion: A portable Win32 userland rootkit
A Catalog of Windows Local Kernel-mode Backdoor Techniques

Malwareslides

W32.Stuxnet Dossier
Stuxnet 0.5: The Missing Link
W32.Duqu: The precursor to the next Stuxnet
THE DUQU 2.0: Technical Details FLAME – The Story of Leaked Data Carried by Human Vector

Intrusion Detectionslides

Bro: A System for Detecting Network Intruders in Real-Time
Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection
Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics
The Base-Rate Fallacy and its Implications for the Difficulty of Intrusion Detection
Outside the Closed World:On Using Machine Learning For Network Intrusion Detection
Snort | Zeek | Suricata

Emailslides

Why Johnny Can’t Encrypt: A Usability Evaluation of PGP 5.0
End-To-End
Off-the-Record Communication, or, Why Not To Use PGP
Forward Secrecy for Asynchronous Messages
Neither Snow Nor Rain Nor MITM... An Empirical Analysis of Email Delivery Security
The PGP Problem

Spam and Phishingslides

Understanding the Network-Level Behavior of Spammers
@spam: The Underground on 140 Characters or Less
Click Trajectories: End-to-End Analysis of the Spam Value Chain
The Harvester, the Botmaster, and the Spammer: On the Relations Between the Different Actors in the Spam Landscape

Web Security (slides on Piazza - courtesy of Nick Nikiforakis)

App Isolation: Get the Security of Multiple Browsers with Just One
Robust Defenses for Cross-Site Request Forgery
One-Way Web Hacking
CGI Security Holes
NT Web Technology Vulnerabilities
Perl CGI problems

Privacyslides

Detecting and Defending Against Third-Party Tracking on the Web
Adnostic: Privacy Preserving Targeted Advertising
Privacy-Preserving Social Plugins
Cookieless Monster: Exploring the Ecosystem of Web-based Device Fingerprinting
Device and Data Access when Personal Safety is At Risk

Guest lecture by Nguyen Phong Hoang on Domain Name Encryption

Assessing the Privacy Benefits of Domain Name Encryption

Anonymityslides

Tor: The Second-Generation Onion Router
Low-Cost Traffic Analysis of Tor
Detecting Traffic Snooping in Tor Using Decoys
Everything Old is New Part 2: Why Online Anonymity Matters